403 response

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 104.16.29.235...
* Connected to api.fitbit.com (104.16.29.235) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
} [5 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.2 (IN), TLS handshake, Server hello (2):
{ [108 bytes data]
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [2744 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [333 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [70 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
{ [1 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
* 	 subject: OU=Domain Control Validated; OU=PositiveSSL Multi-Domain; CN=ssl100216.cloudflaressl.com
* 	 start date: May 15 00:00:00 2015 GMT
* 	 expire date: Dec 31 23:59:59 2015 GMT
* 	 subjectAltName: api.fitbit.com matched
* 	 issuer: C=GB; ST=Greater Manchester; L=Salford; O=COMODO CA Limited; CN=COMODO Domain Validation Secure Server CA 2
* 	 SSL certificate verify ok.
} [5 bytes data]
> GET /1/user/-/activities/heart/date/2015-10-19/2015-10-20/1min/time/23:00/01:00.json HTTP/1.1
> Host: api.fitbit.com
> User-Agent: curl/7.45.0
> Accept: */*
> Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjE0NDU2MzMyNDIsInNjb3BlcyI6Indsb2Mgd3BybyB3bnV0IHdzbGUgd3NldCB3aHIgd3dlaSB3YWN0IHdzb2MiLCJzdWIiOiIzUlRLOFYiLCJhdWQiOiIyMjlXSEQiLCJpc3MiOiJGaXRiaXQiLCJ0eXAiOiJhY2Nlc3NfdG9rZW4iLCJpYXQiOjE0NDU2Mjk2NDJ9.lCY3TKLAWhvpv4L8P6S6pNgB_8-AaWy4RwDYH1Maxjo
>

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0{ [5 bytes data]
< HTTP/1.1 403 Forbidden
< Server: cloudflare-nginx
< Date: Fri, 23 Oct 2015 20:02:24 GMT
< Content-Type: application/json;charset=UTF-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Set-Cookie: __cfduid=d3a7272790bc2c7491aca705ebbcba87a1445630544; expires=Sat, 22-Oct-16 20:02:24 GMT; path=/; domain=.fitbit.com; HttpOnly
< X-UA-Compatible: IE=edge,chrome=1
< Expires: Thu, 01 Jan 1970 00:00:00 GMT
< Cache-control: no-cache, must-revalidate
< Pragma: no-cache
< Fitbit-Rate-Limit-Limit: 150
< Fitbit-Rate-Limit-Remaining: 149
< Fitbit-Rate-Limit-Reset: 3456
< Set-Cookie: JSESSIONID=35F45F45D254CB42C50EB974B5610928.fitbit1; Path=/; HttpOnly
< Content-Language: en
< Vary: Accept-Encoding
< X-Frame-Options: SAMEORIGIN
< CF-RAY: 23a00a140f4d2b9a-AMS
<
{ [268 bytes data]

100   261    0   261    0     0    462      0 --:--:-- --:--:-- --:--:--   461
* Connection #0 to host api.fitbit.com left intact
{"errors":[{"errorType":"insufficient_permissions","message":"API client is not authorized by Fitbit to access the resource requested. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."}],"success":false}